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IN THE SPECIFICATION 

Please replace the paragraph on page 4 of the specification, beginning at line 5 with the 
following amended paragraph: 

FIGURE 1 is a simplified block diagram of a virtual private network 
(VPN) 10 configured in a hub-and-spoke configuration with a firewall as the hub 
12 according to the teachings of the present invention. Hub 12 is a customer edge 
(CE) device of Sitei 16, which is coupled to a provider edge (PE) device 14 of a 
provider's network. A site is defined by a Request for Comment (RFC) 2547bis 
as a collection of customer routers with IP connectivity. Virtual private network 
10 is a set of sites, including Sitei 16, Site2 18, Site3 20, and Site 4 22. Provider 
edge device 14 may be directly or indirectly coupled to customer edge devices 
24-28 of Site2 18, Site3 20; and Site4 22, respectively. Communication to and 
from an extranet 30 30 is done via customer edge device CEi 12, which is the 
firewall. According to the teachings of the present invention, this is done using a 
route target filtering scheme which does not have the disadvantages of 
conventional methods. 
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